74 openlast updated

HomeNovember 2026 patch cycleNetScaler ADC and Gateway CTX697305: 9 critical bugs

Patch nowEnterprise

NetScaler ADC and Gateway CTX697305: 9 critical bugs

Part of November 2026 patch cycle

Vendor
Citrix
Products
NetScaler ADC and Gateway 14.1 before 14.1-73.57, NetScaler ADC and Gateway 13.1 before 13.1-64.39, NetScaler ADC FIPS and NDcPP, NetScaler Console before 14.1-74.34, and Citrix Secure Access Client for Windows and Linux
Published
Status
Open

Call: Patch now. Citrix published its first monthly NetScaler security bulletin on Nov 12, and it’s a big one. CTX697305 fixes a long list of memory-safety bugs in NetScaler ADC and Gateway. Nine of them are rated critical (CVSS 4.0 of 9.3 or 9.5). One, CVE-2026-120868, hits every appliance: “All NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration.” Citrix doesn’t say any of them are exploited, and we haven’t seen a public exploit. But NetScaler bugs have a habit of turning up in CISA’s KEV list soon after a bulletin, and watchTowr was already posting about these on Thursday morning. Upgrade the internet-facing Gateways first, this week.

What’s fixed (ADC and Gateway, CTX697305):

  • CVE-2026-120868 (9.3): a memory overflow in packet processing. Affects every deployment, default config included.
  • CVE-2026-107412 (9.5, the highest): “multiple memory overflow vulnerabilities”. Affects appliances set up as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, which covers most remote-access boxes.
  • 9.3 each, feature-dependent: SMPP load balancing (CVE-2026-107407), DNS load balancing with recursive resolution (CVE-2026-107408), DNS over HTTPS (CVE-2026-107409), PUSH virtual servers (CVE-2026-107410), and Email OTP authentication actions (CVE-2026-107415).
  • 8.7 and below: SAML, WebAuth, LDAP, RTSP, GSLB, and other protocol handlers, plus a medium-rated bug (CVE-2026-111348) that writes authentication material to a log on the appliance.

Citrix describes almost all of them as leading to “unpredictable or erroneous behavior or Denial of Service”. It doesn’t claim code execution, but several carry high confidentiality and integrity scores. Treat a crashable edge box as an exposed one.

The other three bulletins:

  • NetScaler Console, CTX697320: CVE-2026-120869 (9.4). “An unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance.” The only precondition is network access to the Console IP. Fixed in 14.1-74.34.
  • Secure Access Client for Windows, CTX697280: CVE-2026-118268 (8.5), a local privilege escalation from standard user to SYSTEM. Fixed in 26.11.1.6.
  • Secure Access Client for Linux, CTX697281: CVE-2026-118269 (8.5), a local privilege escalation from standard user to root. Fixed in 26.10.4.

Who’s hit: Customer-managed NetScaler ADC and Gateway on 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1 FIPS before 14.1-73.58 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.293. Secure Private Access hybrid deployments that use NetScaler instances are included. Citrix patches its own managed cloud services and Adaptive Authentication itself.

What to do:

  • Upgrade ADC/Gateway to 14.1-73.57 or 13.1-64.39 or later (14.1-73.58 FIPS, 13.1-37.293 FIPS/NDcPP). There’s no workaround in the bulletin. Upgrading is the fix.
  • Do the Gateway and AAA virtual servers first. CVE-2026-120868 and CVE-2026-107412 need no login.
  • Upgrade NetScaler Console to 14.1-74.34, and make sure only your management network can reach it.
  • Push the new Secure Access Client builds to endpoints when you get a chance. Those bugs are local, not remote.
  • The bulletin includes config patterns (add vpn vserver, add authentication vserver, add authentication samlAction and so on) for checking which of the feature-dependent CVEs apply to you. Every box needs the update either way.
  • The bulletin only lists supported versions. If you still run an end-of-life release such as 12.1 or 13.0, no fixed build is coming for it, so move up.

We’ll update this if any of these CVEs show up as exploited or in KEV.

Sources: Citrix CTX697305 (ADC/Gateway), CTX697320 (Console), CTX697280 (Secure Access Client for Windows), CTX697281 (Secure Access Client for Linux), heise, SecurityOnline, watchTowr on X.

Sources

More from November 2026 patch cycle